Client Authentication with CertificateIdentifier for StoreType Directory

[pw-sgr]

I'm trying to connect to a OPC UA server using the CertificateIdentifier and CertificateStoreType.Directory as StoreType.

When doing so I get the exception that it couldn't find the private key when signing the certificate with the rsa key.

When debugging the DirectoryCertificateStore class I can see that the created Entry has the paths to the .der certificate in the certs folder and the .pem private key in the private folder of the CertificateIdentifier.StorePath. But the property CertificateWithPrivateKey of the private Entry class in DirectoryCertificateStore is only set, in the initialization, to null and then only checked against null.

Both the certificate and the private key extracted from a .pfx file using openssl.

What am I doing wrong? Is the store type Directory even a valid client authentication method?

Version: 1.4.372.56

[mregen]

my recommendation is to follow the samples to load an ApplicationConfiguration, often times, depending on the target platform, it is not sufficient to load the private key. It also needs to be in the right keystore and accessible.
There is the CheckApplicationCertificate function which deals with these issues implicitly. Modifying the ApplicationCertificate directly often leads to these errors.

[pw-sgr]

I do call CheckApplicationCertificate, but that exception happens in Session.Create(ApplicationConfiguration, ConfiguredEndpoint, bool, string, uint, IUserIdentity, IList<string>, CancellationToken) based on the certificate specified in the UserIdentity.

I haven't specified the UserIdentity part as I thought that was the only way to use the certificate for authentication.

I can't find a project in the samples where the authentication certificate is loaded from a folder, that's why I originally asked

[mregen]

@pw-sgr I see, for client user auth the certificate needs to be loaded and there is no sample yet.
Please look at #2615 and add comments if needed, we will be looking into adding a sample for the console client.

[pw-sgr]

@mregen I've subscribed to issue and will be looking if I can add anything, tank you